Windows events in endpoint activity data

Views:

Note

If the acting process is not shown in the table, the event subject process is the real subject.

Windows Events

Windows event ID

Windows event name

Windows event type

Acting process

Process start

Process

Terminate process

System event

The BITS service created a new job

BITS job

svchost.exe (service name: BITS)

Queue user APC from User Mode

Threat intelligence

In-process page protection change by a user caller

Threat intelligence

WMI operation new trigger

WMI activity

WMI operation created operation

Note

This event is disabled by default. You must enable WMI activity trace logs.

WMI activity

svchost.exe (service name: Windows Management Instrumentation)

Connection initiated

Network

Cross process memory write with NtWriteVirtualMemory

Threat intelligence

Connection accepted

Network

Remote Desktop Services: Session logon succeeded

Terminal services

svchost.exe (service name: LSM)

WMI operation triggered process execution

WMI activity

Queue user APC from Kernel Mode

Threat intelligence

Remote Desktop Services: Session reconnection succeeded

Terminal services

svchost.exe (service name: LSM)

Connection initiated

Network

LdapSearch

LDAP client event

Connection accepted

Network

sendto

Network

recv

Network

Wininit NtShutdownSystem

System shutdown

Wininit received a shutdown request

System shutdown

sendto

Network

recv

Network

100

Task started

Scheduled event

svchost.exe

101

WININET_ROOT_HANDLE_CREATED

iES event source

102

WININET_OPEN_URL_HANDLE_CREATED

iES event source

103

WININET_CONNECT_HANDLE_CREATED

iES event source

104

The system audit log was cleared

Audit log

svchost.exe (service name: Windows Event Log)

106

Task registered

Scheduled event

svchost.exe

110

Task triggered by user

Scheduled event

svchost.exe

119

Scheduled task is triggered at logon

Scheduled event

svchost.exe

129

Created task process

Scheduled event

140

Task registration updated

Scheduled event

svchost.exe

145

MethodJittingStarted

.NET Runtime

151

DomainModuleLoad_V1

.NET Runtime

152

ModuleLoad_V2

.NET Runtime

153

ModuleUnload_V2

.NET Runtime

154

AssemblyLoad_V1

.NET Runtime

155

AssemblyUnload_V1

.NET Runtime

156

AppDomainLoad_V1

.NET Runtime

157

AppDomainUnload_V1

.NET Runtime

187

RuntimeInformationEvent

.NET Runtime

200

Action started

Scheduled event

svchost.exe

200

Stop service

Service event

201

Action completed

Scheduled event

svchost.exe

201

ChangeServiceStartType

Service event

202

ChangeServiceBinaryPath

Service event

203

Action failed to start

Scheduled event

203

ChangeServiceRunUser

Service event

205

StartService

Service event

300

Microsoft Office Alerts

1001

RegisterRawInputDevices is invoked

Keylogger indicator

1002

SetWindowsHookEx is invoked

Keylogger indicator

1003

Multiple GetAsyncKeyState are invoked

Keylogger indicator

1017

Inbound TCP connection

Connection event

1023

XDR_CONNECTION_LISTEN

Connection event

1033

Outbound TCP connection

Network

1034

TcpConnectTcbFailure

Connection event

1040

Beginning a Windows Installer transaction

MSI Activity

1042

Ending a Windows Installer transaction

MSI Activity

1074

System has initiated shutdown/restart

System shutdown

1102

The audit log was cleared

Audit log

svchost.exe (service name: Windows Event Log)

1149

Remote Desktop Services: User authentication succeeded

Other

svchost.exe (service name: TermService)

2004

A rule has been added to the Windows Firewall exception list

Windows Firewall with Advanced Security

svchost.exe (service name: mpssvc)

2071

A rule has been added to the Windows Defender Firewall exception list

Windows Firewall with Advanced Security

svchost.exe (service name: BFE/mpssvc)

2097

A rule has been added to the Windows Defender Firewall exception list

Windows Firewall with Advanced Security

svchost.exe (service name: BFE/mpssvc)

3008

DNS query

DNS

4104

PowerShell script block logging

Note

This event is disabled by default. To enable this event, use the following PowerShell function with administrator privileges:

function Enable-PSScriptBlockLogging
{
    $basePath = 'HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging'
    if(-not (Test-Path $basePath))
    {
        $null = New-Item $basePath -Force
    }
    Set-ItemProperty $basePath -Name EnableScriptBlockLogging -Value "1"
}

PowerShell

4616

The system time was updated

Security status change

4624

An account was successfully logged on

Logon event

winlogon/services/svchost, 0 if remote sign-in

4625

An account failed to log on

Note

To enable this event, run the following command with administrator privileges:

auditpol /set /subcategory:"Logon" /failure:enable

Logon event

4634

An account was logged off

Note

To enable this event, run the following command with administrator privileges:

auditpol /set /subcategory:{0CCE9216-69AE-11D9-BED3-505054503030} /success:enable

Logon event

lsass

4648

A logon was attempted using explicit credentials

Note

To enable this event, run the following command with administrator privileges:

auditpol /set /subcategory:{0CCE9215-69AE-11D9-BED3-505054503030} /success:enable

Logon event

svchost

4657

A registry value was modified (This should be covered by RegSetValueKey event)

Registry event

4661

A handle to an object was requested

Note

To enable this event, run the following command with administrator privileges:

auditpol /set /subcategory:"{0CCE921D-69AE-11D9-BED3-505054503030}","{0CCE921E-69AE-11D9-BED3-505054503030}","{0CCE921F-69AE-11D9-BED3-505054503030}","{0CCE9245-69AE-11D9-BED3-505054503030}" /success:enable /failure:enable
 
auditpol /set /subcategory:"File System","Registry","Kernel Object","Removable Storage" /success:enable /failure:enable

Object event

4663

An attempt was made to access an object

Note

To enable this event, run the following command with administrator privileges:

auditpol /set /subcategory:"{0CCE921D-69AE-11D9-BED3-505054503030}","{0CCE921E-69AE-11D9-BED3-505054503030}","{0CCE921F-69AE-11D9-BED3-505054503030}","{0CCE9245-69AE-11D9-BED3-505054503030}" /success:enable /failure:enable
 
auditpol /set /subcategory:"File System","Registry","Kernel Object","Removable Storage" /success:enable /failure:enable

Object event

4670

Permissions on an object were changed

Note

To enable this event, run the following command with administrator privileges:

auditpol /set /subcategory:"{0CCE921D-69AE-11D9-BED3-505054503030}","{0CCE921E-69AE-11D9-BED3-505054503030}","{0CCE921F-69AE-11D9-BED3-505054503030}","{0CCE9245-69AE-11D9-BED3-505054503030}" /success:enable /failure:enable
 
auditpol /set /subcategory:"File System","Registry","Kernel Object","Removable Storage" /success:enable /failure:enable

Object event

4672

Special privileges assigned to new logon

Note

To enable this event, run the following command with administrator privileges:

auditpol /set /subcategory:{0CCE921B-69AE-11D9-BED3-505054503030} /success:enable

Logon event

lsass

4695

Unprotection of auditable protected data was attempted

Note

To enable this event, run the following command:

auditpol /set /subcategory:"DPAPI Activity" /success:enable

DPAPI activity

lsass.exe

4697

A service was installed in the system

Note

To enable this event, run the following command with administrator privileges:

auditpol /set /subcategory:{0CCE9211-69AE-11D9-BED3-505054503030} /success:enable

Service event

lsass

4698

A scheduled task was created

Note

To enable this event, run the following command with administrator privileges:

auditpol /set /subcategory:{0CCE9227-69AE-11D9-BED3-505054503030} /success:enable
auditpol /set /subcategory:"Other Object Access Events" /success:enable

Scheduled event

lsass

4699

A scheduled task was deleted

Note

To enable this event, run the following command with administrator privileges:

auditpol /set /subcategory:{0CCE9227-69AE-11D9-BED3-505054503030} /success:enable
auditpol /set /subcategory:"Other Object Access Events" /success:enable

Scheduled event

lsass

4700

A scheduled task was enabled

Note

To enable this event, run the following command with administrator privileges:

auditpol /set /subcategory:{0CCE9227-69AE-11D9-BED3-505054503030} /success:enable
auditpol /set /subcategory:"Other Object Access Events" /success:enable

Scheduled event

lsass

4701

A scheduled task was disabled

Note

To enable this event, run the following command with administrator privileges:

auditpol /set /subcategory:{0CCE9227-69AE-11D9-BED3-505054503030} /success:enable
auditpol /set /subcategory:"Other Object Access Events" /success:enable

Scheduled event

lsass

4702

A scheduled task was updated

Note

To enable this event, run the following command with administrator privileges:

auditpol /set /subcategory:{0CCE9227-69AE-11D9-BED3-505054503030} /success:enable
auditpol /set /subcategory:"Other Object Access Events" /success:enable

Scheduled event

lsass

4703

A user right was adjusted

Note

To enable this event, run the following command with administrator privileges:

auditpol /set /subcategory:"Token Right Adjusted Events" /success:enable

Token privileges adjusted

4719

The system audit policy changed

Note

To enable this event, run the following command with administrator privileges:

auditpol /set /subcategory:{0CCE9235-69AE-11D9-BED3-505054503030} /success:enable

Security status changed

4720

A user account was created

User account event

lsass

4722

A user account was enabled

Note

To enable this event, run the following command with administrator privileges:

auditpol /set /subcategory:{0CCE9235-69AE-11D9-BED3-505054503030} /success:enable

User account event

lsass

4723

An attempt was made to change an account's password

Note

To enable this event, run the following command with administrator privileges:

auditpol /set /subcategory:{0CCE9235-69AE-11D9-BED3-505054503030} /success:enable /failure:enable

Logon event

lsass

4724

An attempt was made to reset an account's password

Note

To enable this event, run the following command with administrator privileges:

auditpol /set /subcategory:{0CCE9235-69AE-11D9-BED3-505054503030} /success:enable /failure:enable

Logon event

lsass

4726

A user account was deleted

Note

To enable this event, run the following command with administrator privileges:

auditpol /set /subcategory:{0CCE9235-69AE-11D9-BED3-505054503030} /success:enable

User account event

lsass

4738

A user account was changed

Note

To enable this event, run the following command with administrator privileges:

auditpol /set /subcategory:{0CCE9235-69AE-11D9-BED3-505054503030} /success:enable

User account event

lsass

4740

A user account was locked out

Note

To enable this event, run the following command with administrator privileges:

auditpol /set /subcategory:{0CCE9235-69AE-11D9-BED3-505054503030} /success:enable

User account event

lsass

4768

A Kerberos authentication ticket (TGT) was requested

Note

To enable this event, run the following command with administrator privileges:

auditpol /set /subcategory:"{0CCE9242-69AE-11D9-BED3-505054503030}" /success:enable

Kerberos event

4769

A Kerberos service ticket was requested

Note

To enable this event, run the following command with administrator privileges:

auditpol /set /subcategory:"{0CCE9240-69AE-11D9-BED3-505054503030}" /success:enable

Kerberos event

4778

A session was reconnected to a Windows Station

Note

To enable this event, run the following command with administrator privileges:

auditpol /set /subcategory:{0CCE921C-69AE-11D9-BED3-505054503030} /success:enable

Logon event

4779

A session was disconnected from a Windows Station

Note

To enable this event, run the following command with administrator privileges:

auditpol /set /subcategory:{0CCE921C-69AE-11D9-BED3-505054503030} /success:enable

Logon event

4793

The Password Policy Checking API was called

Note

To enable this event, run the following command with administrator privileges:

auditpol /set /subcategory:"Other Account Management Events" /success:enable

Account management

4798

A user's local group membership was enumerated.

Account management

4799

A security-enabled local group membership was enumerated

Account management

5140

A network share object was accessed

Note

To enable this event, run the following command with administrator privileges:

aauditpol /set /subcategory:"{0CCE9224-69AE-11D9-BED3-505054503030}" /success:enable /failure:enable

#disable
auditpol /set /subcategory:"{0CCE9224-69AE-11D9-BED3-505054503030}" /success:disable /failure:disable

Network share

5156

The Windows Filtering Platform has permitted a connection

Note

To enable this event, run the following command with administrator privileges:

auditpol /set /subcategory:{0CCE9226-69AE-11D9-BED3-505054503030} /success:enable

#disable
auditpol /set /subcategory:{0CCE9226-69AE-11D9-BED3-505054503030} /success:disable

Connection event

5379

Credential Manager credentials were read

User account management

lsass

5381

Vault credentials were read

User account management

5827

NetLogon connection denied (machine account)

NetLogon

0 (None)

5828

NetLogon connection denied (trust account)

NetLogon

5829

NetLogon connection allowed

NetLogon

5830

NetLogon connection allowed by group policy (machine account)

Note

To enable this event, you must update Default Domain Controller Policy to allow vulnerable connections. For more information, see the Microsoft documentation.

NetLogon

0 (None)

5831

NetLogon connection allowed by group policy (trust account)

NetLogon

5857

WMI operation started operation

WMI activity

5859

WMI operation ESS (Event SubSystem) started

WMI activity

5860

WMI operation temporary ESS started

WMI activity

5861

WMI operation ESS to consumer binding

WMI activity

svchost.exe

6006

The event log service was stopped

System shutdown

7040

The start type of a service has been changed

Service event

services.exe

7045

A service was installed in the system

Service event

services.exe

8225

VSS (Volume Shadow Copy Service) operation

VSS operation

None